While I don't want to fully defend Cloudflare's customer-hostile practices here, it's worth noting that the text you quote is only for if a domain expires:
> In the event that Registrant fails to renew the domain name in a timely fashion, the registration will expire and Cloudflare may, at its discretion, elect to assume the registration and may hold it in its own account, delete it, or sell it to a third party.
I mention this because without that context it looks even worse.
If they alter the domain status to pendingdelete, as stated by the OP, the domain is de facto expired.
And the same Domain Registration Agreement gives them the unlimited right, at their sole discretion, to modify the registration of a domain for a number of reasons, for which it seems you have no other recourse than hoping to be on the frontpage of HN even if such decisions were unfounded.
> In the event that Registrant fails to renew the domain name in a timely fashion, the registration will expire and Cloudflare may, at its discretion, elect to assume the registration and may hold it in its own account, delete it, or sell it to a third party.
I mention this because without that context it looks even worse.